Re: remaining libnetfilter_conntrack issues

[Pablo Neira <pablo@eurodev.net>]

[-- Attachment #1: Type: text/plain, Size: 2160 bytes --]

Hi Harald!

Harald Welte wrote:
> I've started to write a new ulogd2 plugin against the new
> libnetfilter_conntrack, and found a number of issues, mostly related to
> header files:
> 
> 1) why do we need 'asm/types.h'?  this is unacceptable
> 2) why do we need 'linux/if.h'?

I just killed those. I'm not aware of having added those by myself, my 
guess is that they are remains of the primitive libctnetlink.

> 3) libnetfilter_conntrack needs to be split into two parts:
> 	a) what is visible to application programs
> 	b) what is visible to extensions
> 4) if we do '3', we can get rid of the ugly "linux_list.h" include

OK, now we have libnetfilter_conntrack.h and 
libnetfilter_conntrack_extensions.h, have a look at the patch below. I'm 
going to commit it asap.

> 5) we'd ideally get rid of the ip_conntrack.h include, too

I just did it, we just need the status bits. So I just took them from 
ip_conntrack.h

> 6) we should ship a copy of both nfnetlink.h and nfnetlink_conntrack.h with the library
>    this way userspace programs can be built without any
>    nfnetlink-enabled kernel headers installed.
> 
> All copies should be performed during the 'distrib' stage, i.e. every
> time we make a release we tell the automake/autoconf system where to
> take a current copy of those headers from.  They would not be present in
> svn.

OK, so we could just do it in autogen.sh, that would be quite straight 
forward. fine with it?

> 7) we put the definition of the 'nfct_handle' into a private header
>    file. this is good practise for encapsulation, since it prevents the
>    application from making any assumptions about its size and/or
>    contents.

Done

> 8) IPv6 addresses are 128bit, not 64!

Aiee, fixed as well.

I think we can release the first 1.0 version of conntrack this week, 
together with the first release of libnetfilter_conntrack. As soon as I 
finish the test for the expectation part of libnetfilter_conntrack (see 
utils) and fix some remaining problems reported on netfilter-devel. 
Then, I'll have a look back at your previous email detailing how to do 
releases, I didn't have time to do it up to now.

cheers,
Pablo

[-- Attachment #2: x --]
[-- Type: text/plain, Size: 7395 bytes --]

Index: extensions/libnetfilter_conntrack_sctp.c
===================================================================
--- extensions/libnetfilter_conntrack_sctp.c	(revision 4394)
+++ extensions/libnetfilter_conntrack_sctp.c	(working copy)
@@ -14,6 +14,7 @@
 #include <netinet/in.h> /* For htons */
 #include <linux/netfilter/nfnetlink_conntrack.h>
 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
+#include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h>
 
 void parse_proto(struct nfattr *cda[], struct nfct_tuple *tuple)
 {
Index: extensions/libnetfilter_conntrack_tcp.c
===================================================================
--- extensions/libnetfilter_conntrack_tcp.c	(revision 4394)
+++ extensions/libnetfilter_conntrack_tcp.c	(working copy)
@@ -14,6 +14,7 @@
 #include <netinet/in.h> /* For htons */
 #include <linux/netfilter/nfnetlink_conntrack.h>
 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
+#include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h>
 
 static const char *states[] = {
 	"NONE",
Index: extensions/libnetfilter_conntrack_icmp.c
===================================================================
--- extensions/libnetfilter_conntrack_icmp.c	(revision 4394)
+++ extensions/libnetfilter_conntrack_icmp.c	(working copy)
@@ -14,6 +14,7 @@
 #include <netinet/in.h> /* For htons */
 #include <linux/netfilter/nfnetlink_conntrack.h>
 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
+#include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h>
 
 void parse_proto(struct nfattr *cda[], struct nfct_tuple *tuple)
 {
Index: extensions/libnetfilter_conntrack_udp.c
===================================================================
--- extensions/libnetfilter_conntrack_udp.c	(revision 4394)
+++ extensions/libnetfilter_conntrack_udp.c	(working copy)
@@ -14,6 +14,7 @@
 #include <netinet/in.h> /* For htons */
 #include <linux/netfilter/nfnetlink_conntrack.h>
 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
+#include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h>
 
 void parse_proto(struct nfattr *cda[], struct nfct_tuple *tuple)
 {
Index: include/libnetfilter_conntrack/libnetfilter_conntrack_extensions.h
===================================================================
--- include/libnetfilter_conntrack/libnetfilter_conntrack_extensions.h	(revision 0)
+++ include/libnetfilter_conntrack/libnetfilter_conntrack_extensions.h	(revision 0)
@@ -0,0 +1,28 @@
+/*
+ * (C) 2005 by Pablo Neira Ayuso <pablo@eurodev.net>
+ *
+ * This software may be used and distributed according to the terms
+ * of the GNU General Public License, incorporated herein by reference.
+ */
+
+#ifndef _LIBNETFILTER_CONNTRACK_EXTENSIONS_H_
+#define _LIBNETFILTER_CONNTRACK_EXTENSIONS_H_
+
+#include "linux_list.h"
+
+struct nfct_proto {
+	struct list_head head;
+	
+	char 		*name;
+	u_int8_t 	protonum;
+	char		*version;
+	
+	void (*parse_proto)(struct nfattr **, struct nfct_tuple *);
+	void (*parse_protoinfo)(struct nfattr **, struct nfct_conntrack *);
+	int (*print_protoinfo)(char *, union nfct_protoinfo *);
+	int (*print_proto)(char *, struct nfct_tuple *);
+};
+
+extern void nfct_register_proto(struct nfct_proto *h);
+
+#endif
Index: include/libnetfilter_conntrack/libnetfilter_conntrack.h
===================================================================
--- include/libnetfilter_conntrack/libnetfilter_conntrack.h	(revision 4394)
+++ include/libnetfilter_conntrack/libnetfilter_conntrack.h	(working copy)
@@ -9,13 +9,9 @@
 #define _LIBNETFILTER_CONNTRACK_H_
 
 #include <netinet/in.h>
-#include <asm/types.h>
-#include <linux/if.h>
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h> 
 #include <libnfnetlink/libnfnetlink.h>
-#include <linux/netfilter_ipv4/ip_conntrack.h>
-#include "linux_list.h"
 
 #define LIBNETFILTER_CONNTRACK_VERSION "0.2.0"
 
@@ -57,7 +53,7 @@
 struct nfct_tuple {
 	union {
 		u_int32_t v4;
-		u_int64_t v6;
+		u_int32_t v6[4];
 	} src;
 
 	union {
@@ -112,18 +108,6 @@
 	unsigned int id;
 };
 
-struct nfct_proto {
-	struct list_head head;
-	
-	char 		*name;
-	u_int8_t 	protonum;
-	char		*version;
-	
-	void (*parse_proto)(struct nfattr **, struct nfct_tuple *);
-	void (*parse_protoinfo)(struct nfattr **, struct nfct_conntrack *);
-	int (*print_protoinfo)(char *, union nfct_protoinfo *);
-	int (*print_proto)(char *, struct nfct_tuple *);
-};
 
 enum {
 	NFCT_STATUS_BIT = 0,
@@ -151,6 +135,58 @@
 	NFCT_ID = (1 << NFCT_ID_BIT)
 };
 
+/* Bitset representing status of connection. Taken from ip_conntrack.h
+ * 
+ * Note: For backward compatibility this shouldn't ever change
+ * 	 in kernel space.
+ */
+enum ip_conntrack_status {
+	/* It's an expected connection: bit 0 set.  This bit never changed */
+	IPS_EXPECTED_BIT = 0,
+	IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),
+
+	/* We've seen packets both ways: bit 1 set.  Can be set, not unset. */
+	IPS_SEEN_REPLY_BIT = 1,
+	IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),
+
+	/* Conntrack should never be early-expired. */
+	IPS_ASSURED_BIT = 2,
+	IPS_ASSURED = (1 << IPS_ASSURED_BIT),
+
+	/* Connection is confirmed: originating packet has left box */
+	IPS_CONFIRMED_BIT = 3,
+	IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),
+
+	/* Connection needs src nat in orig dir.  This bit never changed. */
+	IPS_SRC_NAT_BIT = 4,
+	IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),
+
+	/* Connection needs dst nat in orig dir.  This bit never changed. */
+	IPS_DST_NAT_BIT = 5,
+	IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),
+
+	/* Both together. */
+	IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),
+
+	/* Connection needs TCP sequence adjusted. */
+	IPS_SEQ_ADJUST_BIT = 6,
+	IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),
+
+	/* NAT initialization bits. */
+	IPS_SRC_NAT_DONE_BIT = 7,
+	IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),
+
+	IPS_DST_NAT_DONE_BIT = 8,
+	IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),
+
+	/* Both together */
+	IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),
+
+	/* Connection is dying (removed from lists), can not be unset. */
+	IPS_DYING_BIT = 9,
+	IPS_DYING = (1 << IPS_DYING_BIT),
+};
+
 enum {
 	NFCT_MSG_UNKNOWN,
 	NFCT_MSG_NEW,
@@ -163,14 +199,6 @@
 typedef int (*nfct_handler)(struct nfct_handle *cth, struct nlmsghdr *nlh,
 			    void *arg);
 
-struct nfct_handle {
-	struct nfnl_handle nfnlh;
-	nfct_callback callback;		/* user callback */
-	nfct_handler handler;		/* netlink handler */
-};
-
-extern void nfct_register_proto(struct nfct_proto *h);
-
 /*
  * [Allocate|free] a conntrack
  */
Index: src/libnetfilter_conntrack.c
===================================================================
--- src/libnetfilter_conntrack.c	(revision 4397)
+++ src/libnetfilter_conntrack.c	(working copy)
@@ -17,6 +17,7 @@
 #include "linux_list.h"
 #include <libnfnetlink/libnfnetlink.h>
 #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
+#include <libnetfilter_conntrack/libnetfilter_conntrack_extensions.h>
 
 #define NFCT_BUFSIZE 4096
 
@@ -26,6 +27,13 @@
 	((unsigned char *)&addr)[2], \
 	((unsigned char *)&addr)[3]
 
+/* Harald says: "better for encapsulation" ;) */
+struct nfct_handle {
+	struct nfnl_handle nfnlh;
+	nfct_callback callback;		/* user callback */
+	nfct_handler handler;		/* netlink handler */
+};
+
 static char *lib_dir = LIBNETFILTER_CONNTRACK_DIR;
 static LIST_HEAD(proto_list);
 static char *proto2str[IPPROTO_MAX] = {